> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Multi-factor authentication

> Register hardware security keys or passkeys for sign-in, and require them for every member of an organization.

## Overview

Tracecat supports FIDO2 security keys and passkeys as a second factor at sign-in. Any WebAuthn authenticator that verifies the user with a PIN or biometric works, including:

* Hardware keys such as the YubiKey 5 and Security Key series.
* Passkeys saved in Chrome and Google Password Manager, 1Password, iCloud Keychain, or Windows Hello.

Tracecat rejects older U2F-only keys that cannot verify a PIN or biometric.

Once you register a key, Tracecat asks for it at every sign-in. This applies to password, OIDC, and SAML sign-in alike. Service account API keys are not affected.

Until you register your first key, your password or SSO sign-in is the only factor on your account, and anyone who signs in as you can register that first key. Register yours as soon as your organization requires one.

## Requirements

Browsers only offer security keys on HTTPS or `localhost`. Tracecat takes the relying party ID and origin from `TRACECAT__PUBLIC_APP_URL`, and keys stay bound to that host. If you change the domain, every user has to register their keys again. On a deployment served over plain HTTP or from an IP address, the MFA settings stay disabled and show the reason.

## Register a security key

Open Settings, select Security, enter a name for the key, and select `Add security key`. Then follow your browser's prompt to tap your key or confirm a passkey.

![Security keys and passkeys in Settings](https://mintcdn.com/tracecat/ChGmSQwb0MqnQWMK/img/authentication/mfa-settings-security.png?fit=max\&auto=format\&n=ChGmSQwb0MqnQWMK\&q=85\&s=fc13a0e0f28146dd20ea43c2bf35fffa)

When you register your first key, Tracecat shows 10 recovery codes once. Store them somewhere safe: each code signs you in once if you lose your key. Select `Generate new recovery codes` to replace the whole set.

![Recovery codes shown after registering a key](https://mintcdn.com/tracecat/ChGmSQwb0MqnQWMK/img/authentication/mfa-recovery-codes.png?fit=max\&auto=format\&n=ChGmSQwb0MqnQWMK\&q=85\&s=c9771fd2b8be14768803480cc1ece76b)

You can register several keys and remove any of them from the list. Tracecat blocks removing your last key while your organization requires one.

## Sign in with a security key

After your password or SSO sign-in, Tracecat opens `/mfa` and asks for your key. Until you verify, the session can only reach the MFA screen and sign-out.

![Security key prompt at sign-in](https://mintcdn.com/tracecat/ChGmSQwb0MqnQWMK/img/authentication/mfa-challenge.png?fit=max\&auto=format\&n=ChGmSQwb0MqnQWMK\&q=85\&s=f6da3a4f88645631e9ba7fa110c592e4)

If you've lost your key, select `Use a recovery code` and enter one of your saved codes.

## Require MFA for an organization

An organization administrator with `org:settings:update` can turn on `Require security key` under Multi-factor authentication at `/organization/settings/security`. You must have registered a key yourself before you can turn it on.

![Require security key for an organization](https://mintcdn.com/tracecat/ChGmSQwb0MqnQWMK/img/authentication/mfa-org-policy.png?fit=max\&auto=format\&n=ChGmSQwb0MqnQWMK\&q=85\&s=7673170aaca5053b8c24de33d91eb227)

Members without a key must register one at their next sign-in before they can continue. Members who already have a key get the security key prompt instead. Existing sessions that haven't verified with a key are stopped at the MFA screen on their next request. Policy changes reach every API replica within 30 seconds.

![Required key registration at sign-in](https://mintcdn.com/tracecat/ChGmSQwb0MqnQWMK/img/authentication/mfa-enroll.png?fit=max\&auto=format\&n=ChGmSQwb0MqnQWMK\&q=85\&s=8721afc8a2ef344f08f6abfc6fed2f1e)

The check runs at sign-in. If any of your organizations requires MFA, you verify with your key when you sign in, whichever organization you open afterwards.

## Related pages

* See [IP allowlist](https://docs.tracecat.com/manage-platform/ip-allowlist.md) to restrict sign-in and admin access to approved addresses.
* See [SAML](https://docs.tracecat.com/authentication/saml.md) and [OIDC](https://docs.tracecat.com/authentication/oidc.md) to configure single sign-on alongside security keys.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.